Privacy policy

Data controller

Within the meaning of art. 19 of the Swiss Federal Act on Data Protection (FADP), the controller for the processing described below is:

Registered name

[to be completed: Registered name]

Legal form

Sole proprietorship under Swiss law

Owner

[to be completed: Owner]

Swiss business identification number (UID)

[to be completed: Swiss business identification number (UID)]

Address

[to be completed: Address]

Email

contact@suni-immo.ch

What this policy covers

This policy describes the personal data we process when you browse suni-immo.ch, when you write to us, and when you apply for an apartment we are letting.

It covers our whole letting and rental management business. The website has no user account and no client area: everything below starts with a step you take towards us.

Data from the contact form

The form on the website is used to request a rent estimate, to set up a search alert, or to ask a question. It collects:

• your name,
• your email address,
• your phone number, if you provide one,
• the path you selected, owner or tenant, and the subject of your request,
• the free text of your message,
• the IP address the form was sent from.

The IP address is included in the notification email we receive. It is used to cap the number of submissions per hour and to spot automated ones. It is not used to identify you.

The form is not connected to any database. Your request reaches us by email, and nothing about it remains on the website server.

Data in a rental application file

A rental application contains far more intimate information than a contact form. We ask for it only when you apply for a specific apartment, never beforehand, and never through the website form.

Depending on the property and on the landlord’s requirements, the file may include:

• your civil status, date of birth, nationality and, where applicable, your residence permit,
• a copy of your identity document,
• the composition of your household and any pets,
• your employment situation, your employer and proof of income, such as payslips or an employment contract,
• an extract from the debt enforcement register,
• a reference or the contact details of your previous landlord,
• proof of private liability insurance.

This information concerns your financial situation and your private life. Some of it, such as data relating to criminal or administrative proceedings, is sensitive personal data within the meaning of art. 5 FADP. We handle it with particular care and ask for it only to the extent needed to assess your application.

You are not required to answer questions unrelated to entering into a tenancy. Declining to provide a necessary document may, however, prevent your application from being assessed.

What the data is used for

Every processing operation serves a specific purpose:

• answering your request and sending you a written rent estimate,
• telling you about apartments matching your search, if you asked for an alert,
• assessing applications, then submitting the shortlisted files to the landlord,
• preparing, entering into and performing the tenancy and the management mandate,
• meeting our legal obligations, in particular accounting and tax obligations,
• protecting the website against automated submissions and abuse.

We do not use your data for advertising or profiling, and we do not sell it.

What the processing relies on

For a private person, the FADP does not require a legal basis in the sense of European law. Our processing follows the principles of art. 6 FADP: a specific purpose that is recognisable to you, data limited to what is necessary, accurate and kept secure.

Where processing requires a justification within the meaning of art. 31 FADP, that justification is, depending on the case:

• your consent, for search alerts and for passing your application file to the landlord,
• performance of the contract, or pre-contractual steps taken at your request, for handling your enquiry, assessing your application and managing the tenancy,
• a legal obligation, for retaining accounting records,
• an overriding private interest, for the security of the website and the prevention of abuse.

If you write to us from a European Union member state, the General Data Protection Regulation may apply in parallel. The rights set out below are exercised in the same way.

Who receives your data

Your data leaves our hands only in the following cases:

• the landlord of the property, for shortlisted applications only, and only for the apartment you applied for,
• our technical service providers, listed in the next section,
• the people who handle our bookkeeping and invoicing, to the extent necessary,
• the authorities, where the law requires us to respond.

Applications that are not shortlisted are passed on to no one. We do not sell or rent out your data, and we never share it for advertising purposes.

Our processors

We deliberately rely on a small number of providers:

• Infomaniak Network SA, in Switzerland, for hosting the website. The servers are located in Switzerland.
• Resend Inc., in the United States, for delivering the notification emails sent from the contact form. The content of your message passes through this provider.
• our email provider, which hosts the mailbox where your requests arrive.

The website uses no content delivery network, no mapping service and no social media widget. Fonts are served from our own server, so your browser sends no request to Google Fonts.

Audience measurement involves no processor at all: it runs on our own servers, in Switzerland. Browsing the website therefore triggers no request to any third party.

Transfers abroad

The website is hosted, and application files are kept, in Switzerland.

There is one exception: notification emails from the contact form are delivered by Resend Inc., a United States company. The Federal Council recognises the United States as providing adequate protection only for companies certified under the Swiss-U.S. Data Privacy Framework. This transfer is covered by the data processing agreement concluded with that provider, which provides appropriate safeguards within the meaning of art. 16 para. 2 FADP.

Audience measurement involves no transfer whatsoever: the statistics are produced and stored on our own servers, in Switzerland.

If you would rather the content of your message did not pass through that provider, write to us directly at our email or postal address.

How long we keep it

We keep your data only for as long as it serves the purpose you entrusted it to us for.

• Contact form request with no follow-up: twelve months from the last exchange.
• Search alert: until you unsubscribe, and at the latest twelve months after the last contact.
• Application not shortlisted: the documents are destroyed at the latest three months after the apartment is allocated. If you ask us to, we keep only your contact details and search criteria, so we can offer you other apartments.
• Application accepted and tenancy signed: for the term of the tenancy, then five years after it ends, to cover claims that may still arise from it.
• Accounting records and supporting documents: ten years, as required by art. 958f of the Swiss Code of Obligations.
• IP address held by the form submission limit: one hour at most, in the server’s memory, never written to disk.

The copy of your identity document is kept only for as long as it takes to verify your identity. It is destroyed afterwards, at the latest when the tenancy is signed.

Security

The website is served over HTTPS. The form accepts submissions from the website itself only, caps the number of submissions per hour and per IP address, and rejects automated ones.

Application files reach us by email or by hand. They are kept in restricted access storage, are never published, and are not stored on the website.

The server delivering the pages keeps technical logs holding the IP address, the timestamp and the page requested. They serve security and troubleshooting purposes and are kept only as long as needed for that.

Cookies and audience measurement

This website uses no advertising tracker and no social media button, and it sells no browsing data.

It does offer audience measurement, Matomo, which we run on our own servers in Switzerland. It tells us how many people visit the website, which pages they arrive on and on what devices, so that we know what is worth improving.

This measurement needs no prior consent, and it is the way it is configured that makes that so: your IP address is truncated by two octets before being stored, no data goes to a third party, your browsing is not followed from one of our websites to another, and nothing feeds advertising. We rely on our legitimate interest in knowing how our own website is used.

Your browser’s “Do Not Track” signal is honoured: when it is on, no measurement takes place.

You can decline the measurement at any time, from the button below or through the “Cookies” link in the footer. Declining sets a single “matomo_ignore” cookie, whose only purpose is to remember your choice. The website works exactly the same either way.

• What is recorded: the pages viewed, the date and time, the referrer, the device type, the browser, and a truncated IP address from which only the country remains.
• The cookies set are first-party cookies (`_pk_id`, `_pk_ses`), kept thirteen months at most, and serve only to tell visits apart.

Matomo is free software. Because it runs on our own infrastructure, nobody but us has access to these statistics: they are never sold, never combined with another source and never used for advertising.

Automated decisions

Applications are assessed by a person. No decision producing legal effects is taken by automated means within the meaning of art. 21 FADP.

The rent estimator on the website is a calculation carried out in your browser and shown on your screen. It decides nothing and records nothing.

Your rights

In respect of data concerning you, you may:

• request access to your data and obtain a copy of it, art. 25 FADP,
• have inaccurate data corrected, art. 32 FADP,
• request the deletion or destruction of your data,
• object to a processing operation,
• obtain your data in a common format, or have it transferred to a third party, art. 28 FADP,
• withdraw a consent you have given, without affecting what was done before the withdrawal.

To exercise any of these rights, write to the email or postal address given at the top of this page. We answer as quickly as we can, as a rule within thirty days.

We may ask you for proof of identity where there is any doubt, so as not to hand your data to someone else.

Some requests come up against a legal retention obligation. In that case we tell you plainly, with the reason and the period concerned.

If you believe your rights are not being respected, you may contact the Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern.

Changes

This policy is updated if our business or our tools change. The version that applies is the one published on this page, bearing the date shown at the top.